OAuth

client.oauth — identity and token exchange.

Official docs: OAuth2.

For a full walkthrough, see the OAuth cookbook.

When to use which

Goal	Method	Auth on client
Linked profiles + granted scopes	me	{ type: "oauth", … }
Code → access token	exchangeToken	None (public POST)

me() does not accept API tokens or session cookies — only OAuth access tokens. For token/session identity use player.whoAmI.

me()

GET /oauth/me — OAuth access token required

type GetOAuthIdentityResult = {
  application: {
    client_id: string;
    scopes: string[];
  };
  profiles: Record<
    string, // uuid
    {
      username: string;
      primary: boolean;
      rank: string;
      supportRank: string | null;
      shortenedRank: string | null;
      legacyRankColour: { main: string; sub: string };
      rankBadge: string;
      accessRules: Record<string, string>;
    }
  >;
};

const client = new WynnClient({
  auth: { type: "oauth", accessToken: process.env.WYNN_OAUTH_ACCESS_TOKEN! },
});

const { data } = await client.oauth.me();
const primary = Object.values(data.profiles).find((p) => p.primary);
console.log(data.application.scopes, primary?.username);

exchangeToken(options)

POST /oauth/token — no prior auth

Sends application/x-www-form-urlencoded via toOAuthTokenFormBody.

Option	Type	Description
code	string	Authorization code from the redirect
redirectUri	string	Must match the registered redirect
clientId	string	Application client ID
clientSecret?	string	Confidential clients
codeVerifier?	string	PKCE verifier for public clients

Result

type ExchangeOAuthTokenResult = {
  access_token: string;
  token_type: "bearer";
  scope: string;
};

const { data } = await new WynnClient().oauth.exchangeToken({
  code: "...",
  redirectUri: "https://example.com/callback",
  clientId: process.env.WYNN_OAUTH_CLIENT_ID!,
  codeVerifier: process.env.WYNN_OAUTH_CODE_VERIFIER,
});

const authed = new WynnClient({
  auth: { type: "oauth", accessToken: data.access_token },
});

Related

• Authentication
• OAuth cookbook
• Session auth (different credential type)
• CDN assets for rankBadge